plandex-ai/plandex · error

no auth header

Error message

no auth header

What it means

GetAuthHeader succeeded but returned nil (no auth header present), so execAuthenticate logs 'no auth header' and, when raiseErr is true, returns HTTP 401. Distinguished from 801: the header was absent rather than malformed/unreadable.

Source

Thrown at app/server/handlers/auth_helpers.go:479

}

func execAuthenticate(w http.ResponseWriter, r *http.Request, requireOrg bool, raiseErr bool) *types.ServerAuth {
	log.Println("authenticating request")

	parsed, err := GetAuthHeader(r)

	if err != nil {
		log.Printf("error getting auth header: %v\n", err)
		if raiseErr {
			http.Error(w, "error getting auth header", http.StatusInternalServerError)
		}
		return nil
	}

	if parsed == nil {
		log.Println("no auth header")
		if raiseErr {
			http.Error(w, "no auth header", http.StatusUnauthorized)
		}
		return nil
	}

	// validate the token
	authToken, err := db.ValidateAuthToken(parsed.Token)

	if err != nil {
		log.Printf("error validating auth token: %v\n", err)

		writeApiError(w, shared.ApiError{
			Type:   shared.ApiErrorTypeInvalidToken,
			Status: http.StatusUnauthorized,
			Msg:    "Invalid auth token",
		})
		return nil
	}

View on GitHub (pinned to e2d772072e)

Solutions

1. Log in / obtain an auth token and send it in the Authorization header
2. Check the client's auth interceptor is attached to the request
3. Route unauthenticated traffic to endpoints that use AuthenticateOptional
4. Return 401 to the user so the client can redirect to login

if req.Header.Get("Authorization") == "" {
	// redirect to login / attach token before calling
	return ErrNotAuthenticated
}

if err := doCall(ctx); err != nil {
	var apiErr *APIError
	if errors.As(err, &apiErr) && apiErr.StatusCode == 401 && strings.Contains(apiErr.Message, "no auth header") {
		return redirectToLogin()
	}
	return err
}

When it happens

Trigger: Any request to an Authenticate-wrapped endpoint with no Authorization header at all.

Common situations: Logged-out users hitting protected endpoints, browser fetch calls without credentials, health checks or scrapers hitting authenticated routes.

Related errors

• error setting auth header: auth not loaded
• invalid auth header
• error getting auth header
• no org id
• User does not have permission to invite user with role:

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/dd5c0ebc9162c85b. Report an issue: GitHub.